_build_docker.yaml

# Copyright (c) 2023 - 2024, Oracle and/or its affiliates. All rights reserved.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.

# This is a reuseable workflow to build and test the Docker image. Note that this workflow does not
# push the built Docker image. This reuseable workflow needs two mandatory inputs:
#   artifact-name: The name of the artifact to download. This is the same artifact generated by _build.yaml
#   artifact-sha256: The hash to verify against the downloaded artifact.

name: Build and push Docker image
on:
  workflow_call:
    inputs:
      artifact-name:
        required: true
        type: string
      artifact-sha256:
        required: true
        type: string
permissions:
  contents: read

jobs:
  build-docker:
    runs-on: ubuntu-latest
    permissions:
      packages: read
    steps:

    - name: Check out repository
      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      with:
        fetch-depth: 0

    # The Docker integration tests require Python 3.11.
    - name: Set up Python
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: '3.11'

    - name: Download artifact
      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
      with:
        name: ${{ inputs.artifact-name }}
        path: dist

    # Verify hashes by first computing hashes for the artifacts and then comparing them
    # against the hashes for the artifact.
    - name: Verify the artifact hash
      env:
        ARTIFACT_HASH: ${{ inputs.artifact-sha256 }}
      run: |
        set -euo pipefail
        echo "Hash of package should be $ARTIFACT_HASH."
        echo "$ARTIFACT_HASH" | base64 --decode | sha256sum --strict --check --status || exit 1

    # Build the Docker image without pushing it.
    - name: Build the Docker image
      env:
        IMAGE_NAME: ghcr.io/oracle/macaron
      run: make build-docker

    - name: Install dependencies for integration test utility
      run: make setup-integration-test-utility-for-docker

    # Run the integration tests against the built Docker image.
    - name: Test the Docker image
      env:
        # This environment variable will be picked up by run_macaron.sh.
        MACARON_IMAGE_TAG: test
        DOCKER_PULL: never
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: make integration-test-docker